The threat actor Clop (stylized as CL0P^_- LEAKS) has claimed responsibility for a large-scale data exfiltration campaign. On November 5-6, 2025, a long list of high-profile corporate victims appeared on the group’s dedicated Tor leak site.

The incident appears to be a coordinated “double extortion” attack, where the primary goal was data theft for the purpose of ransom, rather than network-wide encryption.

Affected Organizations

The Clop leak site lists numerous victims. The initial list of major enterprises includes:

• Logitech (logitech.com)
• Elsewedy Electric (elsewedyelectric.com)
• Wood (woodplc.com)
• Rheem (rheem.com)
• International (international.com)
• Trimble (trimble.com)
• Kirby Corporation (kirbycorp.com)
• Kier Group (kier.co.uk)
• MKS Instruments (mks.com)

Further analysis of the leak site shows dozens of other organizations, including Harvard University (harvard.edu) and Ansell (ansell.com), indicating a widespread and significant campaign.

TTPs (Tactics, Techniques, and Procedures)

While the exact initial access vector is not confirmed, the TTPs observed are highly consistent with previous Clop campaigns.

1. Mass Exploitation (Likely Initial Access): The simultaneous naming of dozens of unrelated, large-scale victims strongly suggests the exploitation of a common, widespread zero-day vulnerability. Clop is famously associated with exploiting vulnerabilities in secure file transfer (MFT) solutions, such as past exploits in MOVEit, Accellion, and GoAnywhere. It is highly probable that a new or similar zero-day vulnerability in an edge-facing appliance was used for initial access.
2. Data Exfiltration: The group’s primary objective was data theft. The leak site data shows listings for “Headquarters” and “Phone,” suggesting the exfiltration of sensitive corporate and potentially personal data.
3. Double Extortion & Public Leak: The group is using a dedicated Tor leak site to publicly name and shame victims. This is a classic double-extortion tactic designed to pressure victims into paying a ransom to prevent the public release of stolen data. The data appears to be organized into “archives” (/archive10/companys-part-2/, etc.) for a structured, phased release.

IOCs (Indicators of Compromise)

Security teams and technical staff should use the following IOCs to investigate potential exposure.

• Threat Actor:
  • Clop
  • CL0P^_- LEAKS
• Network IOC (Tor Leak Site):
  • http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion